diff --git a/init/Android.bp b/init/Android.bp
index 9edbe9d..b209c47 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -292,9 +292,6 @@
         "make_f2fs",
         "mke2fs",
         "sload_f2fs",
-
-        // TODO: Revert after go/android-memcgv2-exp b/386797433
-        "memcgv2_activation_depth",
     ],
 }
 
@@ -694,10 +691,3 @@
         default: ["init_first_stage"],
     }),
 }
-
-// TODO: Revert after go/android-memcgv2-exp b/386797433
-sh_binary {
-    name: "memcgv2_activation_depth",
-    src: "memcgv2_activation_depth.sh",
-    filename_from_src: true,
-}
diff --git a/init/libprefetch/prefetch/src/tracer/mem.rs b/init/libprefetch/prefetch/src/tracer/mem.rs
index f69ae80..42120da 100644
--- a/init/libprefetch/prefetch/src/tracer/mem.rs
+++ b/init/libprefetch/prefetch/src/tracer/mem.rs
@@ -320,8 +320,8 @@
     // Convenience function to create regex. Used once per life of `record` but multiple times in
     // case of tests.
     pub fn get_trace_line_regex() -> Result<Regex, Error> {
-        // TODO: Fix this Regex expression for 5.15 kernels. This expression
-        // works only on 6.1+. Prior to 6.1, "<page>" was present in the output.
+        // `page=[hex]` entry exists in 5.x kernel format but not in 6.x.
+        // Conversely, `order=[digit]` entry exists in 6.x kernel format but not in 5.x.
         Regex::new(concat!(
             r"^\s+(?P<cmd_pid>\S+)",
             r"\s+(?P<cpu>\S+)",
@@ -330,9 +330,10 @@
             r"\s+mm_filemap_add_to_page_cache:",
             r"\s+dev\s+(?P<major>[0-9]+):(?P<minor>[0-9]+)",
             r"\s+ino\s+(?P<ino>\S+)",
-            //r"\s+(?P<page>\S+)",
+            r"(?:\s+(?P<page>page=\S+))?",
             r"\s+(?P<pfn>\S+)",
-            r"\s+ofs=(?P<offset>[0-9]+)"
+            r"\s+ofs=(?P<offset>[0-9]+)",
+            r"(?:\s+(?P<order>\S+))?"
         ))
         .map_err(|e| Error::Custom {
             error: format!("create regex for tracing failed with: {}", e),
@@ -682,22 +683,30 @@
 
     use super::*;
 
-    static TRACE_BUFFER: &str = r#"
- Settingide-502  [001] ....   484.360292: mm_filemap_add_to_page_CACHE: dev 254:6 ino cf1 page=68d477 pfn=59833 ofs=32768
- Settingide-502  [001] ....   484.360311: mm_filemap_add_to_page_cache: dev 254:6 ino cf1 page=759458 pfn=59827 ofs=57344
- BOX_ENTDED-3071 [001] ....   485.276715: mm_filemap_add_to_pag_ecache: dev 254:6 ino 1 page=00cc1c pfn=81748 ofs=13574144
- BOX_ENTDED-3071 [001] ....   485.276990: mm_filemap_add_to_page_cache: dev 254:6 ino cf2 page=36540b pfn=60952 ofs=0
- .gms.peent-843  [001] ....   485.545516: mm_filemap_add_to_page_cache: dev 254:6 ino 1 page=002e8b pfn=58928 ofs=13578240
- .gms.peent-843  [001] ....   485.545820: mm_filemap_add_to_page_cache: dev 254:6 ino cf3 page=6233ce pfn=58108 ofs=0
-      an.bg-459  [001] ....   494.029396: mm_filemap_add_to_page_cache: dev 254:3 ino 7cf page=c5b5c7 pfn=373933 ofs=1310720
-      an.bg-459  [001] ....   494.029398: mm_filemap_add_to_page_cache: dev 254:3 ino 7cf page=b8b9ec pfn=410074 ofs=1314816
-       "#;
+    static TRACE_BUFFER: &str = concat!(
+        // kernel 5.x
+        " Settingide-502  [001] ....   484.360292: mm_filemap_add_to_page_CACHE: dev 254:6 ino cf1 page=68d477 pfn=59833 ofs=32768\n",
+        " Settingide-502  [001] ....   484.360311: mm_filemap_add_to_page_cache: dev 254:6 ino cf1 page=759458 pfn=59827 ofs=57344\n",
+        " BOX_ENTDED-3071 [001] ....   485.276715: mm_filemap_add_to_pag_ecache: dev 254:6 ino 1 page=00cc1c pfn=81748 ofs=13574144\n",
+        " BOX_ENTDED-3071 [001] ....   485.276990: mm_filemap_add_to_page_cache: dev 254:6 ino cf2 page=36540b pfn=60952 ofs=0\n",
+        " .gms.peent-843  [001] ....   485.545516: mm_filemap_add_to_page_cache: dev 254:6 ino 1 page=002e8b pfn=58928 ofs=13578240\n",
+        " .gms.peent-843  [001] ....   485.545820: mm_filemap_add_to_page_cache: dev 254:6 ino cf3 page=6233ce pfn=58108 ofs=0\n",
+        "      an.bg-459  [001] ....   494.029396: mm_filemap_add_to_page_cache: dev 254:3 ino 7cf page=c5b5c7 pfn=373933 ofs=1310720\n",
+        "      an.bg-459  [001] ....   494.029398: mm_filemap_add_to_page_cache: dev 254:3 ino 7cf page=b8b9ec pfn=410074 ofs=1314816\n",
+
+        // kernel 6.x
+        " logcat-686     [006] ..... 148216.040320: mm_filemap_add_to_page_CACHE: dev 254:85 ino 3f15 pfn=0x213bc2 ofs=528384 order=0\n",
+        " logcat-686     [001] ..... 148217.776227: mm_filemap_add_to_page_cache: dev 254:85 ino 3f15 pfn=0x21d306 ofs=532480 order=0\n",
+        " logcat-686     [003] ..... 148219.044389: mm_filemap_add_to_pag_ecache: dev 254:85 ino 3f15 pfn=0x224b8d ofs=536576 order=0\n",
+        " logcat-686     [001] ..... 148220.780964: mm_filemap_add_to_page_cache: dev 254:85 ino 3f15 pfn=0x1bfe0a ofs=540672 order=0\n",
+        " logcat-686     [001] ..... 148223.046560: mm_filemap_add_to_page_cache: dev 254:85 ino 3f15 pfn=0x1f3d29 ofs=544768 order=0",
+    );
 
     fn sample_mem_traces() -> (String, Vec<Option<TraceLineInfo>>) {
         (
             TRACE_BUFFER.to_owned(),
             vec![
-                None,
+                // 5.x
                 None,
                 Some(TraceLineInfo::from_fields(254, 6, 0xcf1, 57344, 484360311000)),
                 None,
@@ -706,7 +715,12 @@
                 Some(TraceLineInfo::from_fields(254, 6, 0xcf3, 0, 485545820000)),
                 Some(TraceLineInfo::from_fields(254, 3, 0x7cf, 1310720, 494029396000)),
                 Some(TraceLineInfo::from_fields(254, 3, 0x7cf, 1314816, 494029398000)),
+                // 6.x
                 None,
+                Some(TraceLineInfo::from_fields(254, 85, 0x3f15, 532480, 148217776227000)),
+                None,
+                Some(TraceLineInfo::from_fields(254, 85, 0x3f15, 540672, 148220780964000)),
+                Some(TraceLineInfo::from_fields(254, 85, 0x3f15, 544768, 148223046560000)),
             ],
         )
     }
diff --git a/init/memcgv2_activation_depth.sh b/init/memcgv2_activation_depth.sh
deleted file mode 100644
index 91d215d..0000000
--- a/init/memcgv2_activation_depth.sh
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/bin/sh
-
-# This script adjusts overrides of the memcg v2 MaxActivationDepth value at runtime.
-# The override value needs to be accessible starting very early in the Android boot, where aconfig
-# flags and system properties do not work. A file on /metadata is used instead.
-
-# The kernel allows this to be as high as 65535, but our Android hierarchy is never that deep.
-MAX_ALLOWED_DEPTH=5
-
-# Store overridden MaxActivationDepths here for libprocessgroup to find them
-OVERRIDE_FILE_PATH="/metadata/libprocessgroup/memcg_v2_max_activation_depth"
-
-if [ "$#" -ne 1 ]
-then
-    echo "Usage: $0 <memcg v2 MaxActivationDepth value>"
-    exit 99
-fi
-
-max_activation_depth=$1
-
-if [[ $max_activation_depth != +([0-9]) ]]
-then
-    echo "MaxActivationDepth value must be a positive integer: $max_activation_depth"
-    exit 98
-fi
-
-if [ $max_activation_depth -lt 0 ]
-then
-    echo "Negative MaxActivationDepth is invalid: $max_activation_depth"
-    exit 97
-fi
-
-if [ $max_activation_depth -gt $MAX_ALLOWED_DEPTH ]
-then
-    echo "MaxActivationDepth is too large: $max_activation_depth"
-    exit 96
-fi
-
-grep memory /sys/fs/cgroup/cgroup.controllers
-if [ $? -ne 0 ]
-then
-    echo "memcg v2 is not available on this device!"
-    exit 95
-fi
-
-current_activation_depth=$(cat $OVERRIDE_FILE_PATH)
-if [ $? -ne 0 ]
-then
-    # Find the default activation depth in the absence of any properties / overrides.
-    #
-    # To do this 100% correctly requires JSON parsing which we don't really want to do here.
-    # We know that this will be called only for Pixel (for a limited-duration experiment), and that
-    # Pixel does not override cgroups.json, therefore we can assume that the system cgroups.json has
-    # only a single MaxActivationDepth entry which corresponds to the v2 memory controller. So we
-    # can just grep for the default value.
-    default_activation_depth=$(grep MaxActivationDepth /system/etc/cgroups.json | tr -dc '0-9')
-    if [ $? -ne 0 -o $default_activation_depth -gt $MAX_ALLOWED_DEPTH ]
-    then
-        # If MaxActivationDepth is not present, libprocessgroup does not limit how deep it will activate
-        default_activation_depth=$MAX_ALLOWED_DEPTH
-    fi
-    current_activation_depth=$default_activation_depth
-fi
-
-# libprocessgroup will pick this up for all future cgroup creations, including on the next boot
-echo $max_activation_depth > $OVERRIDE_FILE_PATH
-chmod ugo+r $OVERRIDE_FILE_PATH
-
-if [ $max_activation_depth -lt $current_activation_depth ]
-then
-    # We can deactivate memcgs which are deeper than the new depth value, however that would leave
-    # behind zombie memcgs which would ruin the metrics produced from this device. The only way to
-    # eliminate those zombies is to remove the entire cgroup, which we cannot do without killing
-    # all the contained processes. So the only real option we have is to reboot here, but that would
-    # look like a random reboot to users. So don't do anything now. Wait until the next reboot for
-    # the new setting to be applied.
-    :
-elif [ $max_activation_depth -gt $current_activation_depth ]
-then
-    for d in $(seq $max_activation_depth)
-    do
-        for f in $(find /sys/fs/cgroup/ -mindepth $d -maxdepth $d -name cgroup.subtree_control)
-        do
-            echo "+memory" > $f
-        done
-    done
-fi
diff --git a/libcutils/include/private/android_filesystem_config.h b/libcutils/include/private/android_filesystem_config.h
index 2aaafbe..b6aded0 100644
--- a/libcutils/include/private/android_filesystem_config.h
+++ b/libcutils/include/private/android_filesystem_config.h
@@ -144,6 +144,7 @@
 #define AID_UPROBESTATS 1093         /* uid for uprobestats */
 #define AID_CROS_EC 1094             /* uid for accessing ChromeOS EC (cros_ec) */
 #define AID_MMD 1095                 /* uid for memory management daemon */
+#define AID_UPDATE_ENGINE_LOG 1096   /* GID for accessing update_engine logs */
 // Additions to this file must be made in AOSP, *not* in internal branches.
 // You will also need to update expect_ids() in bionic/tests/grp_pwd_test.cpp.
 
diff --git a/libprocessgroup/profiles/cgroups.json b/libprocessgroup/profiles/cgroups.json
index dbf736a..e9345a5 100644
--- a/libprocessgroup/profiles/cgroups.json
+++ b/libprocessgroup/profiles/cgroups.json
@@ -36,7 +36,7 @@
         "Controller": "memory",
         "Path": ".",
         "NeedsActivation": true,
-        "MaxActivationDepth": 0,
+        "MaxActivationDepth": 3,
         "Optional": true
       }
     ]
diff --git a/libprocessgroup/util/util.cpp b/libprocessgroup/util/util.cpp
index a15a44f..c772bc5 100644
--- a/libprocessgroup/util/util.cpp
+++ b/libprocessgroup/util/util.cpp
@@ -18,19 +18,15 @@
 
 #include <algorithm>
 #include <iterator>
-#include <mutex>
 #include <optional>
 #include <string_view>
 
 #include <mntent.h>
-#include <unistd.h>
 
 #include <android-base/file.h>
 #include <android-base/logging.h>
-#include <android-base/parseint.h>
 #include <android-base/properties.h>
 #include <android-base/stringprintf.h>
-#include <android-base/strings.h>
 #include <json/reader.h>
 #include <json/value.h>
 
@@ -178,38 +174,6 @@
     return mounts;
 }
 
-// Keep the override file open to reduce open syscalls, but read it every time.
-// Note that memcgv2_activation_depth.sh can race with us here.
-std::optional<unsigned int> ReadMaxActivationDepthMetadataOverride() {
-    static const char* OVERRIDE_FILE_PATH =
-        "/metadata/libprocessgroup/memcg_v2_max_activation_depth";
-    static int override_fd = open(OVERRIDE_FILE_PATH, O_RDONLY | O_CLOEXEC);
-    static std::mutex mtx;
-
-    std::unique_lock lock(mtx);
-    if (override_fd < 0) {
-        override_fd = open(OVERRIDE_FILE_PATH, O_RDONLY | O_CLOEXEC);
-        if (override_fd < 0) return std::nullopt;
-    }
-
-    std::string depth_str;
-    const bool ret = android::base::ReadFdToString(override_fd, &depth_str);
-    lseek(override_fd, 0, SEEK_SET);
-    lock.unlock();
-
-    if (!ret) {
-        PLOG(ERROR) << "Failed to read max activation depth override";
-        return std::nullopt;
-    }
-
-    unsigned int depth;
-    if (!android::base::ParseUint(android::base::Trim(depth_str), &depth)) {
-        PLOG(ERROR) << "Failed to convert max activation depth override (" << depth_str << ')';
-        return std::nullopt;
-    }
-    return depth;
-}
-
 }  // anonymous namespace
 
 
@@ -271,10 +235,7 @@
 bool ActivateControllers(const std::string& path, const CgroupDescriptorMap& descriptors) {
     for (const auto& [name, descriptor] : descriptors) {
         const uint32_t flags = descriptor.controller()->flags();
-        uint32_t max_activation_depth;
-        std::optional<unsigned int> metadataMaxDepth = ReadMaxActivationDepthMetadataOverride();
-        if (metadataMaxDepth) max_activation_depth = *metadataMaxDepth;
-        else max_activation_depth = descriptor.controller()->max_activation_depth();
+        const uint32_t max_activation_depth = descriptor.controller()->max_activation_depth();
         const unsigned int depth = GetCgroupDepth(descriptor.controller()->path(), path);
 
         if (flags & CGROUPRC_CONTROLLER_FLAG_NEEDS_ACTIVATION && depth < max_activation_depth) {
diff --git a/rootdir/init.rc b/rootdir/init.rc
index c25a9ac..471059b 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -614,9 +614,6 @@
 
     mkdir /metadata/staged-install 0770 root system
 
-    # TODO: Revert after go/android-memcgv2-exp b/386797433
-    mkdir /metadata/libprocessgroup 0775 root system
-
 on late-fs
     # Ensure that tracefs has the correct permissions.
     # This does not work correctly if it is called in post-fs.
@@ -790,7 +787,8 @@
     mkdir /data/misc/vold 0700 root root
     mkdir /data/misc/boottrace 0771 system shell
     mkdir /data/misc/update_engine 0700 root root
-    mkdir /data/misc/update_engine_log 02750 root log
+    mkdir /data/misc/update_engine_log 02750 root update_engine_log
+    chown root update_engine_log /data/misc/update_engine_log
     mkdir /data/misc/trace 0700 root root
     # create location to store surface and window trace files
     mkdir /data/misc/wmtrace 0700 system system
@@ -997,8 +995,11 @@
     mkdir /data/misc/stats-service/ 0770 statsd system
     mkdir /data/misc/train-info/ 0770 statsd system
 
-    # Wait for apexd to finish activating APEXes before starting more processes.
+    # TODO(b/400439023): Remove once attest modules flagging is removed.
     wait_for_prop apexd.status activated
+    # Wait for KeyMints to receive APEX module info before starting code from updateable APEXes.
+    # This is to prevent APEX modules from interfering in module measurement.
+    wait_for_prop keystore.module_hash.sent true
     perform_apex_config
 
     exec_start system_aconfigd_mainline_init
@@ -1320,34 +1321,14 @@
 # Multi-Gen LRU Experiment
 on property:persist.device_config.mglru_native.lru_gen_config=none
   write /sys/kernel/mm/lru_gen/enabled 0
-  # Memcg v2 Experiment
-  # TODO: Revert after go/android-memcgv2-exp b/386797433
-  exec - system system -- /system/bin/memcgv2_activation_depth.sh 0
-  setprop persist.device_config.lmkd_native.psi_partial_stall_ms 70
 on property:persist.device_config.mglru_native.lru_gen_config=core
-  write /sys/kernel/mm/lru_gen/enabled y
-  # Memcg v2 Experiment
-  # TODO: Revert after go/android-memcgv2-exp b/386797433
-  exec - system system -- /system/bin/memcgv2_activation_depth.sh 1
-  setprop persist.device_config.lmkd_native.psi_partial_stall_ms 56
+  write /sys/kernel/mm/lru_gen/enabled 1
 on property:persist.device_config.mglru_native.lru_gen_config=core_and_mm_walk
-  write /sys/kernel/mm/lru_gen/enabled y
-  # Memcg v2 Experiment
-  # TODO: Revert after go/android-memcgv2-exp b/386797433
-  exec - system system -- /system/bin/memcgv2_activation_depth.sh 1
-  setprop persist.device_config.lmkd_native.psi_partial_stall_ms 70
+  write /sys/kernel/mm/lru_gen/enabled 3
 on property:persist.device_config.mglru_native.lru_gen_config=core_and_nonleaf_young
-  write /sys/kernel/mm/lru_gen/enabled y
-  # Memcg v2 Experiment
-  # TODO: Revert after go/android-memcgv2-exp b/386797433
-  exec - system system -- /system/bin/memcgv2_activation_depth.sh 2
-  setprop persist.device_config.lmkd_native.psi_partial_stall_ms 70
+  write /sys/kernel/mm/lru_gen/enabled 5
 on property:persist.device_config.mglru_native.lru_gen_config=all
-  write /sys/kernel/mm/lru_gen/enabled y
-  # Memcg v2 Experiment
-  # TODO: Revert after go/android-memcgv2-exp b/386797433
-  exec - system system -- /system/bin/memcgv2_activation_depth.sh 3
-  setprop persist.device_config.lmkd_native.psi_partial_stall_ms 70
+  write /sys/kernel/mm/lru_gen/enabled 7
 
 # Allow other processes to run `snapshotctl` through `init`. This requires
 # `set_prop` permission on `snapshotctl_prop`.